T1055 Process Injection
EnterpriseAdversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-techniques (12)
More specific entries beneath this one.
mitigations
ATT&CK mitigations that reduce this.
detected by (7)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 5 of 12 mapped controls
- PR.DSData Securitymoderate · backed by 5 of 12 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 4 of 12 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (12)
Security controls that mitigate this.
known-exploited CVEs (19)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-25257US | critical9.8OT critical | KEV | ||
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.… | ||||
| CVE-2025-21480US | —OT critical | KEV | ||
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. | ||||
| CVE-2025-31324US | critical9.8OT critical | KEV | ||
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries tha… | ||||
| CVE-2024-58136US | critical9.8OT critical | KEV | ||
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 202… | ||||
| CVE-2025-24993US | —OT critical | KEV | ||
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-1316US | critical9.8OT critical | KEV | ||
Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device | ||||
| CVE-2025-22224US | high8.2OT critical | KEV | ||
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges… | ||||
| CVE-2025-0108US | critical9.1OT critical | KEV | ||
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authenticat… | ||||
| CVE-2025-21418US | —OT critical | KEV | ||
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | ||||
| CVE-2024-40891US | —OT critical | KEV | ||
**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4… | ||||
| CVE-2024-40890US | —OT critical | KEV | ||
**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_2017… | ||||
| CVE-2025-25181US | high7.5OT critical | KEV | ||
A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter. | ||||
| CVE-2025-0282US | critical9.0OT critical | KEV | ||
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.… | ||||
| CVE-2024-50603US | critical9.8OT critical | KEV | ||
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthent… | ||||
| CVE-2024-56145US | critical9.8OT critical | KEV | ||
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini… | ||||
| CVE-2024-6047US | —OT critical | KEV | ||
Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execu… | ||||
| CVE-2023-6548US | high8.8OT critical | KEV | ||
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to p… | ||||
| CVE-2023-34192US | critical9.0OT critical | KEV | ||
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function. | ||||
| CVE-2020-29574US | critical9.8OT critical | KEV | ||
An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely. | ||||
attack patterns (2)
CAPEC attack patterns that exploit this.
groups (15)
Threat groups associated with this.
software (66)
Malware and tools associated with this.
campaigns (7)
Campaigns that use this.
Detected by (Sigma) (37)
Sigma detection rules related to this.
source
Where this definition is published.